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Thank you so much. And you’re stuck with me for another seven years and 10 
months—not that I’m counting. But thank you for the citation, and back at you, Cy. 
Thank you for your leadership on so many issues, but especially on all things cyber and 
especially the encryption challenge that we face, which I’ll say a few words about. 

Let me begin, though, by saying that my heart, as I’m sure is true of everybody in this 
auditorium, remains heavy, after the tremendous loss suffered by the people of France 
and the people of the world on Friday night. We have long had a very close 
counterterrorism relationship with our French colleagues. It remains strong, it will be 
strong, we will lean on it very hard in the days ahead. As you know, we, together with 
our partners—and I’m in a city that is the best example in this nation of the partnerships 
at the federal, state, and local levels on counterterrorism—we are working around the 
clock to make sure that such things do not happen here in the United States, and I’m 
very grateful for the partnerships. 

We’re here, though, today to talk about cyber, and I want to share some thoughts with 
you about how the FBI is thinking about it, some of the challenges that we face. And I 
want to touch briefly on why we are talking so much about encryption these days—why 
both the district attorney and I believe this is such an important topic for all of us to care 
about. 








Let me start with how I think about the threat. And I think everyone in this room gets 
this, so I won’t spend a lot of time on this. But sometimes, people who don’t do our 
work, we have to frame it for them in a way that I hope resonates. 

I believe that we stand in the middle of the greatest transformation in human relations in 
human history. And this is a change that affects all of the FBI’s work, because cyber is 
not a thing, it’s a way—it’s a vector. Because we have connected all of our lives to the 
Internet; because it’s where we bank; because it’s where we have social lives— if I had 
one, I’m sure it would be on the Internet. It’s where our children play, it’s where our 
health care is, it’s where our financial information is, it’s where our critical infrastructure 
is. It’s where life is. And that will become more and more true as the “Internet of things” 
becomes a feature of all of our lives, and our sneakers talk to our refrigerator and our 
car talks to our heating system. All of our lives are there, and so those who would do us 
harm—who would steal our money, hurt our kids, damage our infrastructure, look to 
attack our nation—that’s where they come. It is a vector change unlike any we’ve ever 
seen before. 

The modern FBI was born, a little less than a hundred years ago in practical terms, in 
response to the great vector change of the early 20th century—when the confluence of 
asphalt and the automobile introduced a kind of crime that no one had ever seen 
before. You always had robberies, but now they were coming in a vector that was 
unimagined in its scope and in its speed. John Dillinger could do robberies in two states 
in the same day, moving at 55 miles an hour downhill. All of a sudden, county lines were 
very meaningful and state lines were meaningful, and this vector change thwarted law 
enforcement. And so what was needed was a national force to span those boundaries 
and respond to that threat—and the modern FBI was born. I’m the seventh Director, the 
first FBI Director was there, and the modern FBI in a real sense was a response to that 
vector change. 

This vector changes dwarfs that in ways that are even hard to describe, because 
Dillinger could not do a thousand robberies in all 50 states all in the same day in his 
pajamas halfway around the world, moving at the speed of light. That is what we face 
today. So now, county lines—not really meaningful against this threat. State lines, 
international lines are not meaningful against this threat. This threat, moving at 186,000 



miles per second—which I think is the speed of light—shrinks the world to the size of a 
dot, and poses enormous challenges for us. 


So we in the FBI have a strategy, which I want to explain to you very briefly, to try to 
respond to that. But at the core of it is humility. We have never seen a transformation in 
human history like this vector change, so it would be arrogant in the extreme to stand in 
the middle of it and say, “I can see the future. I know how we should be deployed, 
equipped, and trained against this threat, against this vector change that the world has 
never experienced.” 

Instead, we have to approach it with humility and say, we’re going to do things that 
seem reasonable, we’re going to get feedback, and we’re going to iterate, to make sure 
we’re responding to something no one has ever seen before. 

The Bureau’s strategy is pretty straightforward, and it has five parts that I’ll explain to 
you very quickly. 

The first thing we’re trying to do in the FBI is focus ourselves. I think of the threats 
coming at us through that vector as a stack. At the top are nation-state actors coming at 
us through cyber intrusions, looking to steal, obviously, government secrets, steal 
innovation. There are near-state actors working in league with them. There are huge 
international syndicates bent on stealing information, stealing money, stealing identities 
to facilitate other crimes. There are individual criminals, there are hacktivists, there are 
creeps and weirdos of all kinds, there are bullies, there are people sending people e- 
mails saying that I need you to wire money to me in Nigeria or someplace—those are all 
part of the stack, but towards the lower end of the stack. (And don’t ever wire me money 
anywhere, please—I don’t need it and I’m not in Nigeria.) 

What we’re trying to do is focus ourselves on the work that makes the most sense given 
the FBI’s footprint, which is global, and our resources. We’re trying to focus ourselves 
on the top of that stack—on the nation-state intrusions; on the sophisticated 
international criminal syndicates; the enormous botnets—the biggest, most international 
aspects of all things cyber. So doing that, we think that if we can focus ourselves, we’ll 
be better than if we try to do everything. 



And our focus takes a form of assigning the work differently than we have before in the 
FBI. Normally, physical location is an important element of where work is assigned in 
the FBI, for obvious reasons. If a bank robbery happens in Chicago, we’re going to 
assign it to the Chicago office. But physical location is actually not all that meaningful 
when you’re talking about threats that are moving at the speed of light from halfway 
around the world. So we’re actually pushing physical location down a little bit in deciding 
where we assign work. 

We’ve come up with something we call a cyber threat team model, where we assign 
work not based on where the physical manifestation of an intrusion is—what company 
got hit, what bank got hit, and where they’re headquartered—but instead where the 
talent is. So the FBI assigns threats based on where we think the best talent against 
that threat is. That may be in Little Rock, Arkansas, that may be in New York, that may 
be in Tampa, that may be Seattle—even where victim companies are not located in 
those jurisdictions. But, to take account of the fact that physical manifestations matter, 
we assign that one office as the owner of the threat, and we allow up to four other 
offices to assist, to make sure that we’re conducting effective liaison with chief security 
officers, chief information security officers in the physical locations of those companies. 
So that’s the first thing that we’re trying to do—is assign work in a way that respects the 
change in this vector, and then we’ll iterate if it doesn’t make sense. But it seems to be 
working pretty well so far. 

So the first part of our strategy is focus. The second part is, we think, because the bad 
guys moving at the speed of light have shrunk the world to the size of a pin, we have to 
shrink it back. And that has two elements in our strategy, two elements of our “shrink” 
strategy. 

First is, we’re going to deploy more of our people around the world. We’re going to push 
our analysts, and our cyber agents, our experts, to more and more places around the 
world—because even though this is an infrastructure-, a fiber-optic-based threat, those 
physical relationships, especially with our foreign partners where the keyboards may sit 
in their jurisdictions, matter tremendously. So you’re going to see more and more FBI 
people pushed out around the world to try and shrink it back. 



The second way we’re trying to shrink the world is shrink the world inside the federal 
government. When I left government last in 2005, the federal government’s response to 
the cyber threat reminded me of 4-year-old soccer. And I have five kids, so I’ve watched 
a lot of 4-year-old soccer—and those of you who’ve seen it, it’s a big clump of kids 
moving together chasing the ball, because the ball’s the thing. It’s the cool thing, it’s the 
important thing, so everybody on the field should go get the ball. 

Returning to government, the good news is, when I came back in 2013, we had gotten 
to a place where everybody understood we have to spread out and we have to pass to 
each other. We had gotten to a place that I would say, probably college-level soccer. 
The challenge we face is that the bad guys are playing World Cup-level soccer. We 
have to continue to work the way we pass the ball, the way we assign positions, and the 
way we see the field and visualize the field. 

At the core of that for the federal government is something called the NCIJTF—the 
National Cyber Investigative Joint Task Force. It’s a mouthful to say, but it’s actually the 
beating heart of avoiding the 4-year-old soccer problem, because that NCIJTF is made 
up of 20 federal agencies from the law enforcement world and the intelligence world, 
that sit together in a facility in the D.C. area, visualize the threat, and share information 
and coordinate their work. “You have a good left foot, you ought to take this shot; I’ve 
got a good right foot, I’ll take that shot. You tell me how it goes, we’ll talk to each other 
so we accomplish the goal of winning the game.” We have very cool facilities there— 
which I’m not going to describe—that allow us to visualize what’s going on, on a 
worldwide basis, with the cyber threat, and chop up the work and pass it to each other. 
We even have close foreign partners now sitting in the same space, to help us shrink 
the world back. 

So that is the second element of our strategy: we’re going to focus ourselves, and then 
we’re going to try and shrink the world. And the reason we’re going to try to do those 
things is we need to, as the third part of our strategy, impose costs. 

All of us who do this work have a sense that people around the world, bad guys around 
the world, think it’s a freebie—that if I’m in my pajamas at a keyboard halfway around 
the world, I can steal anything from—I’m responsible for the United States, I’ll talk about 



the United States—anything from Americans, and it’s a freebie. It’s not like I kicked in 
their door and walked out with their valuables, or walked out with the things that matter 
most to them. It’s not like I harmed their children directly. 

We understand in law enforcement—and we have to make sure the criminals 
understand—that it is the same. Even though you’re in your pajamas, you are still 
terrorizing children, you are still stealing that which matters most to us. And we have to 
get to a place where, even if someone is at the keyboard in their basement somewhere 
on the other side of the earth, they feel us behind them—they can feel our breath on 
their neck. And we have to impose costs to make that happen. We have to lock people 
up, so they understand this is not a freebie. 

Critical to that locking up, that being able to impose costs, is shrinking the world— 
because so often the takedowns that we’re involved in require international cooperation. 
Everybody in this room understands the threat well. It was illustrated vividly recently 
with the announcement, here in the Southern District of New York, of the indictments of 
the hackers who were running, as the U.S. Attorney said, a sophisticated enterprise 
that, at its core, was hacking—to steal personal information, to steal press information, 
to manipulate stock prices, to run basically a multinational criminal enterprise that relied 
upon their ability to hack. Key to taking that down was cooperation. In that case we had 
great cooperation with our friends in Israel, to be able to impose costs by putting 
handcuffs on people around the world all at the same time. 

We have to do more and more of that. Wherever possible, we have to lay hands on 
people, to make sure they understand these are as serious a crime as if you kicked in a 
door in someone’s apartment here in Manhattan. 

If we can’t lay hands on people, we have to call out the conduct. You saw us doing this, 

I hope, over the last year, calling out the conduct of Chinese actors in stealing American 
innovation, in calling out the action of the North Korean government in attacking Sony. 
We hope that by calling it out, naming the conduct, talking about the conduct, we can 
change behavior. And we can lock people up, we can call it out, and third, we have to 
make sure people understand that we have many flaws, because we’re human, but we 
are dogged people—and we do not forget. Even Russian hackers like to go on vacation. 



Even Russian hackers like to go on a honeymoon to somewhere in the Mediterranean. 
We will be there, and we will impose costs in order to change behavior. 


So: focus ourselves; shrink the world, so that we can impose costs. 

The fourth part of our strategy is, we simply must help our state and local partners be 
more effective at investigating in the digital world. In the good old days, you could do a 
search warrant—in a drug case, or an organized crime case—and hit a location 
responding with a judge’s order and find paper. In the good old days, you would find 
black composition notebooks in which the morons would have written who got how 
much—Shorty got this, Joe got that, and changes and names. 

The good old days are gone. Because in any case you work, when you hit that location 
pursuant to a search warrant, you’re going to find thumb drives, PDAs, laptops— 
devices that require digital literacy. Every single investigator in this nation, to be 
effective, has to be a digital investigator. We in the federal government have to do a 
better job of equipping them, especially with the training that they need to be effective. 

There’s great progress being made here as part of our strategy. We and the Secret 
Service are working together to push out training, to make it available to people, so they 
can become certified cyber investigators. Those of you in law enforcement know the 
LEEP portal—that is available on the LEEP portal—people can do most of that training 
from their desks in their police offices around the country. We have to do more and 
more of that to equip our state and local partners. 

I also think that to work more effectively, it does not make sense, at least to my mind, 
that the FBI and the Secret Service each have cyber task forces in cities around the 
country. It makes too much sense to me to combine them. And so we’re actually trying a 
pilot in Atlanta and Boston where we’re going to combine our task forces and see how it 
goes. I think it’ll go fine. I think they have great talent, we have great talent. “Turf” 
makes no sense at all when you’re talking about the volume of threat we face when it 
comes to cyber. So I hope the model you see down the road is us doing that work 
together, and then equipping our state and local partners to do the work—especially in 



the smaller jurisdictions, which don’t have the sophistication and the resources of NYPD 
or the Manhattan D.A.’s office. We have to help them. 

And that leads me to the fifth part of our strategy: we simply must get better at working 
with the private sector. This is an enormous challenge. It’s essential to us, because 
nearly all the information we need to be effective sits on the private sector’s 
infrastructure—which is a great thing; it’s a wonderful thing that the Internet is in private 
hands in the United States. The expertise resides within the private sector, so if we’re 
going to be good at what we do we have to cooperate better. 

In the absence of effective cooperation, we are left, in law enforcement, like police 
officers patrolling the street with 50-foot-high walls on either side. We can tell you with 
high confidence, “The street is safe.” But if we can’t find a way to offer assistance and to 
have vision into the neighborhoods through those walls, we’re not going to be able to 
help the people who live there. 

This faces a bunch of different challenges—legal, technical, and cultural. But it’s not a 
moon landing. This is something, given the stakes, we should be able to accomplish. 

Start with legal. We need clear rules of the road for companies to have them 
understand, if I share information with the government, here’s what happens to it; here’s 
how it can be used; here are the risks associated with that; and here’s how those risks 
are mitigated. There’s good work being done on that—I’m optimistic we’re going to 
solve those problems. 

Second, technical. There are all kinds of good relationships going on to push 
information—a lot of them analog, writing things on a piece of paper. We have to get to 
a place where we share information at machine speed. We have to get to a place where 
we push information to each other in a way that moves at the speed of the threat. 

There’s good work being done here. I hope you know the FBI has worked very, very 
hard in the last two years to get better at pushing information very, very quickly to our 
partners. We’ve pushed out dozens and dozens and dozens of our FLASH alerts, of our 



Private Industry Notifications, our PINs. We’ve put on hundreds of briefings of CISOs 
and trusted partners to make sure they understand the threat. But we have to do more. 

One example of doing more is the Malware Investigator, which I hope you’ve heard of. 
This is a tool that we are making available to the private sector that I think represents 
the future. The FBI has long had our own database of malware. And any FBI agent 
working a case takes a sample of malware and queries our internal database, and then 
gets a hit if we’ve seen that malware before and knows it connects to something in San 
Diego or in Houston. We’re making that tool available to our private sector partners. So 
a private sector partner can sit at the same screen and query our database with their 
malware sample to see what it connects to. 

What’s in it for the private sector is obvious—you get very, very quick responses; know 
what to do, who to go talk to. What’s in it for us is we’ll get more samples of malware, to 
allow our “fingerprint” database in the digital world to get better and more complete and 
more useful to the private sector. We have to do more of that kind of stuff. 

So, legal, technical; maybe the hardest of all over the last two years has been cultural. 
In the so-called post-Snowden world, a wind has blown that has chilled cooperation 
sometimes across the divide between the government and the private sector. We have 
to resist that, by pushing what might have been cynicism back to skepticism. 

People should be skeptical of government power—they should want to know what our 
authorities are, how we use them, how we’re overseen. That’s very, very important. I 
like to explain to people, you should not trust people simply because they seem like 
good people. You should want to know: how are they overseen? What are their 
authorities? What are the checks and balances? I think I’m a good person—don’t trust 
me; ask. What are the details? There’s an angel in those details. 

So we need to continue to have those conversations, to push cynicism to healthy 
skepticism. But also I think events in the world have helped push it back. 

There is no better example of the importance to our entire nation of cooperation than 
the Sony attack. The Sony attack was a vicious, hugely damaging attack to that 



company. But we were able to respond quickly to it, and effectively to it, because Sony 
knew us. All of America’s companies spend lots of time making sure the fire department 
knows your company, so that if there’s a disaster, they know where to go. If it’s in the 
dark, they know how to rescue people. If it’s smoky, they know where to go. They have 
a sense of what’s needed to do to protect people. 

Fortunately, with a company like Sony, they knew us well enough that we could respond 
quickly like that. Companies need to do that. If you’re running a private enterprise in 
America today, you better know us, in a good way, so if something happens, we can 
help you. I see more and more of that happening and it’s helping to calm some of the 
cultural winds that we face—but there’s a lot more work to do there. 

So we are going to: focus ourselves; try to shrink the world; try to impose costs; try to 
work better with our private sector partners; and try to help our state and local partners 
be more effective. We have a long way to go. 

Sometimes an obstacle to private sector cooperation is what I call “weenie general 
counsels.” Now here’s the thing: I was a weenie general counsel, at two different 
companies. And that’s the job of a general counsel—to ask questions like this: “What?” 
Or to say, “What’s the government going to do with that?” or “How might we get hurt by 
this?” and “What if it leaked, or what if it gets used against us in a competition?” or, 
“What a minute—what if people claim we defamed them? Whose information is this?” 

Those are all important questions. We in the government have to engage to make sure 
those folks get good answers to that. But what’s been interesting in the post-Sony world 
is, I think CEOs and boards understand, in a way they might not have before, that it is a 
business imperative to cooperate with the government—in a lawful, appropriate way— 
but to make sure you are in a position to take advantage of our resources, and to make 
sure that we’re in a position appropriate to help you when you are threatened. I think it 
has engaged the general counsels’ clients in a way that it didn’t before, and I think that’s 
a very healthy thing. 

So thank you for your engagement on this. We will get better as a result. And we will 
approach it with humility and take feedback to iterate. 



I want to explain, though, before I say goodbye to you, why this encryption issue that 
the district attorney and I have talked about so much, and Commissioner Bratton has 
talked about so much, matters. 

We are drifting to a place in America where lawful court orders—judicial search 
warrants, judicial wire intercept orders that are the lifeblood of our criminal work to 
protect children, to fight gangs, to solve kidnappings—all the work that we do requires 
that judicial orders be complied with, to have us get the information to stop bad things 
from happening, and to catch and punish those people who have done bad things— 
we’re drifting to a place where increasingly those orders are ineffective, because a 
device is protected by full encryption, or data-in-motion is fully encrypted. 

And the challenge we face is illustrated this way. It’s not a “cryptowar.” I hate the “war” 
metaphor, because wars are fought by people who don’t share values. This 
conversation involves people who all share the same values, whether you work for the 
FBI or you work for a tech company. 

All of us care about two things. All of us care about safety and security on the Internet. I 
am a huge fan of strong encryption. If the government used it better in some 
circumstances, people wouldn’t be reading my security clearance documents in other 
parts of the world. I am a big fan of strong encryption—it helps us protect our 
innovation, it helps us protect our banking information, it helps us protect that which 
matters so much. And it makes my life easier to try to respond to cyber intrusions. 

And all of us care about public safety. All of us care about protecting people, protecting 
children, protecting cities, protecting all the things we’re sworn to protect. 

In the form of strong encryption, we now see a collision between those two values. And 
it’s illustrated no better than through the threat posed to us by the group that we call 
ISIL, the so-called Islamic State—which in the United States, to talk about what they’ve 
been doing here, has been recruiting through social media. And if they find a live one, 
they move them to Twitter direct messaging—which we can get access to with judicial 
process. But if they find somebody they think might kill on their behalf, or might come 
and kill in the caliphate, they move them to a mobile messaging app that’s end-to-end 



encrypted. And at that moment, the needle we’ve been searching the entire nation to 
find, and have found, goes invisible to us. 


That is the Going Dark problem. That is the collision between two values we all care 
about. That is the collision between safety and security on the Internet, which is a great 
thing, and public safety, which is a great thing. 

There is not an easy answer to the resolution of that collision between values. But 
democracies should not drift. Democracies should talk about hard things and figure out, 
how might we deal with this? Because the stakes are too high to drift to a place where 
someday, people look at me or look at the district attorney and say, “Wait a minute, 
what? What do you mean the tools that we rely on you to use aren’t effective?” Our jobs 
are to send up a flare to tell people: those tools you need us to use and you thought we 
were using—there is a big problem with those. 

The FBI is not an alien force imposed on America from Mars. The FBI belongs to the 
American people. We only have the authorities granted to us by the United States 
Congress on behalf of the American people. My job is to tell the American people when 
the tools that you have given us through Congress are being several impaired by a 
collision of two values we all care about. Very, very hard problem—but the stakes 
require us to engage on it and talk about it. 

The good news—thanks to the work that Cy Vance has done, that Bill Bratton has done, 
that we at the FBI have tried to do—is, I think the temperature has come down. I think 
people realize we are not maniacs. We’re maniacs in some ways, we’re not maniacs in 
this way. We see a problem, and serious people who stare at it see the same problem. 
What’s next is: what do we, as smart people, do to try and solve that problem? I’m very 
grateful for Cy’s leadership on this. We have to keep talking about this, because it really 
matters. 

So thank you for engaging on all things cyber. Those of you in the private sector, thank 
you for fighting through cultural headwinds, through practical headwinds, through legal 
headwinds, to find a sustainable, healthy, appropriate, lawful basis for cooperating 



across that divide, so that the street and the neighborhoods are both able to be 
patrolled in a safe way, and all of us are safer and better as a result. 

And I thank you for your time. 



